{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acorazacoraza_waf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:coraza:coraza_waf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4,"id":"CVE-2026-114101"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Coraza WAF (\u003c 3.8.1)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","waf","web-application","bypass"],"_cs_type":"advisory","_cs_vendors":["Coraza"],"content_html":"\u003cp\u003eCoraza WAF versions before 3.8.1 contain a vulnerability (CVE-2026-114101) in the multipart upload filename parsing logic. The underlying use of Go's \u003ccode\u003emime.ParseMediaType\u003c/code\u003e function causes the parser to ignore RFC 5987 \u003ccode\u003efilename*\u003c/code\u003e parameters that utilize non-UTF-8 or non-US-ASCII character sets. An attacker can leverage this behavior by providing a decoy filename parameter while utilizing an unsupported character set encoding (e.g., \u003ccode\u003eiso-8859-1\u003c/code\u003e) to bypass security rules configured to inspect file types or names, allowing malicious files to reach the backend application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the bypass of WAF file-based security rules. This enables an attacker to upload potentially malicious files that would otherwise be blocked by the WAF, increasing the risk of remote code execution or unauthorized file access on the backend application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Coraza to version 3.8.1 or later by updating the dependency in \u003ccode\u003ego.mod\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit existing WAF rules that rely on \u003ccode\u003eFILES\u003c/code\u003e or filename-based inspection to determine if they are susceptible to bypasses using non-standard character set encodings.\u003c/li\u003e\n\u003cli\u003eImplement additional file validation logic on the backend application server as a secondary defense layer, independent of WAF inspection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T01:19:09Z","date_published":"2026-10-23T01:19:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coraza-waf-bypass/","summary":"Coraza WAF versions prior to 3.8.1 contain a filename parsing vulnerability that allows attackers to bypass file-based security rules using specifically crafted multipart upload parameters.","title":"Coraza WAF: Multipart upload filename parsing bypass (CVE-2026-114101)","url":"https://feed.craftedsignal.io/briefs/2026-10-coraza-waf-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:coraza:coraza_waf:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}